Anthony's Computer Forensics

[MD MOMMY]

Interesting! He may have also been looking up missing person's websites to see how they were formated/set up to use as a guide. Good work!

 

[reeseeva]

Thanks JWG, As always you have followed thru to the letter.

I had a feeling that this was a misnomer, as the Media & Nancy G. would still be screaming this over the airwaves.

I hope ButWhatIf also sees this.

:blowkiss:

 

[butwhatif?]

Thanks JWG, As always you have followed thru to the letter.

I had a feeling that this was a misnomer, as the Media & Nancy G. would still be screaming this over the airwaves.

I hope ButWhatIf also sees this.

:blowkiss:

Yep...here I am. Thanks JWG for putting it all together and explaining it.
Can you tell me the doc page where you got all this info please? Great work as usual btw.:clap:

 

[AlwaysShocked]

"I posted yesterday on the escort service surfing activity, and I will have more to say about that in a future post. Suffice it to say, I am 99% certain George is solely responsible for the visits to escort sites, and KC is uninvolved in that surfing activity."

Hoo-boy! Cindy isn't going to like this at all!

By the way, JWG, nice signature line.......... and nice photos in your profile!

 

[Searchfortruth]

Wow JWG, this is IMPRESSIVE ! Thank you so very much for putting it together for all of us..!!!!!!!!!

 

[BondJamesBond]

Thanks, JWG (and Muzikman). Excellent work, indeed! You obviously plowed some time into the research, and organized it so that it was easy to follow. :clap:

This case has certainly given me a heavily jaundiced eye when any 'analysis' comes from the mainstream media. :shakehead:

Now...methinks you're gonna tell us the tale of the BSOD fftheair: very soon. Looking forward to the next chapter... :book:

 

[JWG]

Yep...here I am. Thanks JWG for putting it all together and explaining it.
Can you tell me the doc page where you got all this info please? Great work as usual btw.:clap:

Hi butwhatif...

There is not a document page to reference. I downloaded computer files released by LE in September and looked through those. Surf to my profile page and look for a recent post by Muzikman - there is a link there for a 95MB zip file containing the documents I've been looking at.

That file also contained a couple of Caylee pics (very good resolution) from the visit to Mt. Dora that I had personally not seen before. Worth the download just for those, IMO.

 

[elfie]

I've been looking through the mountain of computer forensic data released last September and uploaded yesterday to a file sharing site by dedicated websleuther Muzikman. :rocker:

I posted yesterday on the escort service surfing activity, and I will have more to say about that in a future post. Suffice it to say, I am 99% certain George is solely responsible for the visits to escort sites, :blushing: and KC is uninvolved in that surfing activity.

This evening I took a close look at the visits to missing person's websites widely reported last September in the media. My conclusion is that KC did not visit missing persons websites prior to Caylee's disappearance. In fact, I do not believe she is responsible for those visits at all.

Following is the raw data for the visits in question:

07/16/2008 14:51:37 06/24/2008 16:01:46 http://www.missingkids.com/photographs/NCMC1097725c1t.jpg
07/16/2008 14:51:31 07/03/2008 01:28:12 http://www.missingkids.com/photographs/NCMC1099693c1t.jpg
07/16/2008 14:51:25 07/10/2008 11:37:33 http://www.missingkids.com/photographs/NCMC1096469c1t.jpg
07/16/2008 14:51:24 05/27/2008 12:58:47 http://www.missingkids.com/photographs/NCMC1096536c1t.jpg
07/16/2008 14:51:24 04/24/2008 16:06:48 http://www.missingkids.com/photographs/NCMC1094062c2t.jpg
07/16/2008 14:51:24 04/24/2008 16:06:48 http://www.missingkids.com/photographs/NCMC1094062c1t.jpg
07/16/2008 14:51:24 05/03/2008 17:07:29 http://www.missingkids.com/photographs/NCMC1094659c1t.jpg
07/16/2008 14:51:24 06/23/2008 15:30:12 http://www.missingkids.com/photographs/NCMC1098504c1t.jpg
07/16/2008 14:51:24 04/24/2008 16:06:48 http://www.missingkids.com/photographs/NCMC1094062c3t.jpg
07/16/2008 14:51:24 06/24/2008 14:14:01 http://www.missingkids.com/photographs/NCMC1098088c1t.jpg
07/16/2008 14:51:24 07/02/2008 19:50:00 http://www.missingkids.com/photographs/NCMC1099149c1t.jpg
07/16/2008 14:51:24 07/01/2008 00:06:13 http://www.missingkids.com/photographs/NCMC1099410c1t.jpg
07/16/2008 14:51:24 03/17/2008 15:47:48 http://www.missingkids.com/photographs/NCMC1091268c1t.jpg

07/16/2008 14:51:24 04/10/2007 12:29:03 http://www.get-involved.com/mashup/marker.swf
07/16/2008 14:51:22 http://www.get-involved.com/mashup/RSS_Read.php?state=XX
07/16/2008 14:51:22 http://www.get-involved.com/mashup/RSS_Read.php?state=XX
07/16/2008 14:51:21 06/19/2007 06:32:24 http://www.get-involved.com/mashup/map_small.swf
07/16/2008 14:51:20 04/26/2007 08:04:49 http://www.get-involved.com/mashup/images/kids_widget_04.gif
07/16/2008 14:51:20 04/26/2007 08:04:48 http://www.get-involved.com/mashup/images/kids_widget_01.gif
07/16/2008 14:51:20 04/26/2007 08:04:49 http://www.get-involved.com/mashup/images/kids_widget_05.gif
07/16/2008 14:51:20 04/26/2007 08:04:49 http://www.get-involved.com/mashup/images/kids_widget_02.gif
07/16/2008 14:43:09 http://www.get-involved.com/mashup/RSS_Read.php?state=XX

There are a few things to note about each item listed. First, the items are objects on the website, such as an image (.gif or .jpg) or shockwave video (.swf). The web browser will store the objects on the computer so that the next time the website is visited, it will appear to load faster than the first time. This is called caching.

The date / time shown in red indicates when the object was accessed by the web browser. This is indicative of when the website was surfed.

The other date / time (if there is one) indicates when the object was last modified by whoever created it or otherwise owned the object. Using an image, for example, this date / time could indicate when the picture was taken, resized, photoshopped...you name it. It is often indicative of when the web page was created or modified. It is not indicative of when the web page was surfed.

Unfortunately, the media saw the old dates and assumed that they were surf dates. LE did not make that assumption. There is nothing in the complete forensic report that indicates they ever thought this was something to look into.

I should further point out that the sites were visited from the laptop computer and not the home computer.

So what really happened? :waitasec:

Recall that Lee picked up KC's computer on the evening of the 15th from Tony's. (I will need to post later on the activity beginning late that night, but in an attempt to keep this post to under five pages, I will stay on topic. )

Sometime during the afternoon of the 16th the "cayleeismissing" myspace page goes live. This page becomes a missing person's website - Caylee's. Work on this page occurred between 2:37 PM and 2:52 PM on July 16th - completely encompassing the time the missing person's sites were accessed.

Given KC was pre-occupied during this time, the best candidate for this activity is ... Lee. He was just trying to get Caylee's name out there as a missing person. :angel:

Thanks for the info & explanations JWG. Very sleuthy!

 

[Muzikman]

Hi butwhatif...

There is not a document page to reference. I downloaded computer files released by LE in September and looked through those. Surf to my profile page and look for a recent post by Muzikman - there is a link there for a 95MB zip file containing the documents I've been looking at.

That file also contained a couple of Caylee pics (very good resolution) from the visit to Mt. Dora that I had personally not seen before. Worth the download just for those, IMO.

Great work JWG. Wish I would have put this up back in Sept! Thought it was out there for everyone...

I also put a couple links in the Jury Room, 10/8 Doc Dump thread, for those that want to download for themselves.

 

[Where's Andre]

I posted yesterday on the escort service surfing activity, and I will have more to say about that in a future post. Suffice it to say, I am 99% certain George is solely responsible for the visits to escort sites, :blushing: and KC is uninvolved in that surfing activity.

Interesting... I look forward to your future post. This was my "gut" as well when you brought this up. I imagine such sites are usually set up for the benefit of customers, not "employees". It stands to reason a typical back-end for a site like that would be pages, or texts, or emails, so that employees get data on-the-road in a more practical universally accessible manner than a web browser.

They don't call them "call girls" for nothing.

 

[JWG]

As I was researching the missing persons website visits on KC's laptop computer, I began to piece together what happened to KC's laptop during the final 24 hours before it was turned over to LE.

Lee arrives at Tony's around midnight, leaving around 2:00AM and arriving back at his parents around 2:25AM (evidence pages 1442 - 1445). While there he sees KC's laptop plugged in and set up on the kitchen counter top. He starts it up but gets the "blue screen of death" indicating the computer was improperly shutdown and data has been lost (page 1478). Lee also states later that, as he is investigating the situation with Caylee after bringing KC's computer back to life, he notices that in KC's Yahoo email account all emails prior to June 15 were deleted (page 1479).

I personally noticed that the internet history before June 27 was deleted, as was July 2 - 9.

Now let's look at the activity...

No activity on July 15 until 8:47 PM, when about 40 seconds worth of AIM activity occurs. My belief is this is when the computer is powered on by Tony, and AIM automatically launches. Nothing happens for 1 1/2 hours.

KC's phone - which is in the possession of Tony, receives texts from Andy F. and Will W., around 9:25. At around 10:05 Tony calls Amy and learns about KC cleaning out her bank account. Tony is probably not emotionally stable at this point.

At 10:15 PM activity resumes. For the next five minutes it looks like there are repeated attempts to log into KC's ATT wireless account, culminating in a visit to the "lost password" page to presumably have a new password sent to her email account. A successful login to Yahoo may have occurred at this time.

Activity resumes again at 10:30 with an attempt to either register with or log into an existing "Lava Life" account. This lasts for about a minute (methinks Tony is looking at the internet history). Attempts are then made to log into Facebook (unsuccessfully).

10:43 PM - a successful attempt to log into myspace is made, although the account is not clear (if I knew the numeric ID for KC I could probably tell). For the next 10 minutes comments and inbox messages are viewed.

10:57 PM - a successful attempt to log into Facebook is made, although the account is not clear. Numerous photos are viewed for the next 3 minutes. Activity stops.

11:15 PM - a return to Facebook with what appears to be a single upload.

11:19 PM - a second attempt to login to the ATT wireless account.

11:23 PM to 11:35 PM - a rapid-fire mixture of myspace and photobucket views. On Photobucket it is images. On myspace it is images and messages.

11:35 PM to 11:50 PM - many, many views of Facebook photos after what appears to be a successful login.

Computer handed over to Lee.

1:40 AM - computer appears to reboot.

2:32 AM - successful login to Yahoo mail. Activity stops at 2:34 (possibly after seeing no email exists).

At 5:09 AM the computer is powered up, but no real activity until 5:18 when the MSN website is brought up. One of the very first things done here is to go to the white pages search off this site and enter "aida" as a first name and "fernandez-gonzalez" as the last name. Lee searches referral sites ussearch.com and reunion.com for ZFG. Activity is very sparse from about 5:25 AM to 1:40 PM.

From 1:40 PM to 2:00 PM or so there are multiple searches on multiple site for combinations of "cheryl davis" "east coast universal" and "battle of the bands" - all of which were figments of KC's imagination. One wonders how he continues believing sis to this day. :waitasec:

After a brief pause of 20 minutes or so, work began on the cayleeismissing, myspace page...Lee's part to understand just what KC was up to.

 

[Muzikman]

10:43 PM - a successful attempt to log into myspace is made, although the account is not clear (if I knew the numeric ID for KC I could probably tell). For the next 10 minutes comments and inbox messages are viewed.

Not 100% positive (99%), but I believe this is KC's original MS Page ID #:
10472558

 

[RR0004]

As I was researching the missing persons website visits on KC's laptop computer, I began to piece together what happened to KC's laptop during the final 24 hours before it was turned over to LE.

Lee arrives at Tony's around midnight, leaving around 2:00AM and arriving back at his parents around 2:25AM (evidence pages 1442 - 1445). While there he sees KC's laptop plugged in and set up on the kitchen counter top. He starts it up but gets the "blue screen of death" indicating the computer was improperly shutdown and data has been lost (page 1478). Lee also states later that, as he is investigating the situation with Caylee after bringing KC's computer back to life, he notices that in KC's Yahoo email account all emails prior to June 15 were deleted (page 1479).

I personally noticed that the internet history before June 27 was deleted, as was July 2 - 9.

Now let's look at the activity...

No activity on July 15 until 8:47 PM, when about 40 seconds worth of AIM activity occurs. My belief is this is when the computer is powered on by Tony, and AIM automatically launches. Nothing happens for 1 1/2 hours.

KC's phone - which is in the possession of Tony, receives texts from Andy F. and Will W., around 9:25. At around 10:05 Tony calls Amy and learns about KC cleaning out her bank account. Tony is probably not emotionally stable at this point.

At 10:15 PM activity resumes. For the next five minutes it looks like there are repeated attempts to log into KC's ATT wireless account, culminating in a visit to the "lost password" page to presumably have a new password sent to her email account. A successful login to Yahoo may have occurred at this time.

Activity resumes again at 10:30 with an attempt to either register with or log into an existing "Lava Life" account. This lasts for about a minute (methinks Tony is looking at the internet history). Attempts are then made to log into Facebook (unsuccessfully).

10:43 PM - a successful attempt to log into myspace is made, although the account is not clear (if I knew the numeric ID for KC I could probably tell). For the next 10 minutes comments and inbox messages are viewed.

10:57 PM - a successful attempt to log into Facebook is made, although the account is not clear. Numerous photos are viewed for the next 3 minutes. Activity stops.

11:15 PM - a return to Facebook with what appears to be a single upload.

11:19 PM - a second attempt to login to the ATT wireless account.

11:23 PM to 11:35 PM - a rapid-fire mixture of myspace and photobucket views. On Photobucket it is images. On myspace it is images and messages.

11:35 PM to 11:50 PM - many, many views of Facebook photos after what appears to be a successful login.

Computer handed over to Lee.

1:40 AM - computer appears to reboot.

2:32 AM - successful login to Yahoo mail. Activity stops at 2:34 (possibly after seeing no email exists).

At 5:09 AM the computer is powered up, but no real activity until 5:18 when the MSN website is brought up. One of the very first things done here is to go to the white pages search off this site and enter "aida" as a first name and "fernandez-gonzalez" as the last name. Lee searches referral sites ussearch.com and reunion.com for ZFG. Activity is very sparse from about 5:25 AM to 1:40 PM.

From 1:40 PM to 2:00 PM or so there are multiple searches on multiple site for combinations of "cheryl davis" "east coast universal" and "battle of the bands" - all of which were figments of KC's imagination. One wonders how he continues believing sis to this day. :waitasec:

After a brief pause of 20 minutes or so, work began on the cayleeismissing, myspace page...Lee's part to understand just what KC was up to.

Ok...a couple of questions...how does Tony get on to the laptop...when did the "blue screen" appear supposedly? I thought it was there when Lee came to pick it up. I also remember a lot of discussion about what went on the morning of the 16th. I believe it was CA talking about how that morning, when Casey was back home, they were all busy setting up the website. Remember how she said they had very little time to talk- Casey took a shower, they were busy setting up the website ('cause Cindy had no idea how) yada yada. If what you're saying is true (and I do believe it is) then all that talk from CA was a bunch of baloney. The website was set up in the afternoon...and Casey was NOT there. Is that correct?
Thanks, JWG!

 

[magic-cat]

I wonder if there was a phone call or more than one phone call from the house or from Lee's cell TO Tony that evening. He is bound to have called to say he was coming for Casey's things? Maybe he said some more things-like look in that computer and see if you can find anything because Caylee is missing? OR they could actually have conspired together AFTER Lee got there and agreed the blue screen of death was a way to protect Casey? The meeting that presumably happened between Tony and Lee that was videoed- I wonder if it is in regard to something they concocted about that computer or something else that they both knew and one decided to tell...It will be interesting to see that and have one teeny tiny question answered...instead of even more questions arising!

By the way-to all of you SUPER SLEUTHS who have done so much dedicated work on this case for the benefit of us all-I thank you...

 

[shgrbkr]

So was TL just snooping on KC after she left with Cindy? Think the texts from Andy and Will prompted Tony to find out if KC was cheating around on him? I'm sorry this sounds like I'm in the 7th grade, but I'm just curious. Didn't TL have his own computer?

 

[JWG]

I will try to answer RR0004. magic-cat, and shgrbkr in this post.

First, I will point out again that the computer was left at Tony's when Cindy came over to get KC, as were KC's clothes and other belongings.

Based on the fact that the computer was booted around 10:15 and activity ceased just before midnight, it is clear that Tony was the one on the computer and not Lee. Lee was still at his parents. Lee arrived at Tony's around midnight and left around 2:00 AM.

Lee did say in his interview that he called Tony in advance to tell him he was coming over to get KC's stuff. Given that Lee had to this point never met nor spoken to Tony before, I think it is highly unlikely that the two of them immediately launched into a conspiracy to protect KC.

Trying to connect the dots and put myself into the player's minds that evening of July 15, what I think happened is...

Tony calls KC's phone at 8:22 PM in an attempt to try to find out from KC what was going on between she and her mother. However, KC had left her phone at Tony's, and he locates it in the process of calling her.

At 9:12 a text comes in from Will W. At 9:27 Tony attempts to call Amy on KC's phone but does not reach her. At 9:35 another text comes in from will and at 9:37 one comes in from Andy F. It is possible that Tony sees these and decides to take a peek at KC's other texts, and discovers quite a few messages that cause him to question KC's fidelity. :waitasec:

Another attempt to call Amy is made at 10:07, immediately followed by a call from Mark H. that goes to VM. Tony calls Amy again and they connect. This is when Tony learns KC cleaned out Amy's bank account.

Ya think maybe Tony's a little bit suspicious of this girl KC now? :sick:

He flips open her laptop and tries to get into her ATT account to see who she might have been calling. Based on the links to "forgotten" or "lost" password on that site, he is not successful.

Next he looks at her browser history to get a sense of where she's been. He notices that the "lava life" dating site had been visited so he goes there to see if he can figure out how to view her profile. It looks like he registered in order to do this.

Tony tries to get into her Facebook, but cannot.:banghead:

Next he tries myspace and is successful logging into her account (thanks Muzikman for digging up her numeric ID - it matched!!!). :dance: Tony spends 10 minutes looking through LOTS of profile comments and mailbox messages, and I am guessing what he sees only makes him that much more upset with her.

Sometime during his viewing of KC's myspace he figures out how to get into her Photobucket and Facebook. For the next hour he is viewing photos on both sites and messages / photos on myspace. I am guessing that what he sees infuriates him, and out of anger starts deleting stuff that upsets him. :furious:

Remember - he does not know at this point that Caylee is missing. He only knows his girlfriend is a thief and a cheat.

Somewhere along the way, in the process of deleting material, Tony accidentally corrupts a system file. This is what causes the blue screen of death. About the time this happens he gets a call from Lee who is headed over.

So Tony gathers up KC's belongings, folds them and stacks them neatly, and waits for Lee to arrive to get that woman's stuff out of his house.

 

[It's Not the Nanny]

I have to wonder if George's Nigerian internet scam was really money going to escort services?? hmmmmm.....


JWG - You always continue to amaze me!! Thank you for clearly showing what happened with her computer.

I would like to see what time Lee's calls to TonE came in.....and for how long they talked.

The only statement you made that I'm not 100% certain of is that TonE ACCIDENTALLY caused the blue screen.

LA could have called TonE and told him KC was in a lot of trouble and to please start deleting.....and he would be over soon to pick up her stuff.

TonE definitely gathered KC's things and probably folded them and packed her bags -- good riddance after what he saw on her computer.

I'm hoping the taped meeting between LA and TonE will give us a better understanding of what exactly happened that night.

 

[debs]

I have to wonder if George's Nigerian internet scam was really money going to escort services?? hmmmmm.....


JWG - You always continue to amaze me!! Thank you for clearly showing what happened with her computer.

I would like to see what time Lee's calls to TonE came in.....and for how long they talked.

The only statement you made that I'm not 100% certain of is that TonE ACCIDENTALLY caused the blue screen.

LA could have called TonE and told him KC was in a lot of trouble and to please start deleting.....and he would be over soon to pick up her stuff.

TonE definitely gathered KC's things and probably folded them and packed her bags -- good riddance after what he saw on her computer.

I'm hoping the taped meeting between LA and TonE will give us a better understanding of what exactly happened that night.

Doesn't seem like whoever looked at the pages spent a whole lot of time there.

 

[lastchance]

Wow, oh, Wow! Great sleuthing, JWG and Muzikman. It really clears up so much for me. This computer thing has always bothered me, but it makes sense that TL would be curious about what the heck was going on. This also could explain how completely he dropped KC after this and why she was so anxious to talk to him while she was in jail. She wanted to get to him before anyone else and give her "side of the story". Does anyone know if they had any contact after that first arrest?

 

[Shannon33]

Casey Myspace friend ID is 10472558...
If that is not the numberical ID in your findings, post it and we can tell you who's page they were logged into. I would find it interesting to learn that Tony had logged into CASEY's Myspace and was deleting messages and comments...